CVE-2026-68587

SiYuan's publish mode exposes three API endpoints (/api/block/getHeadingDeleteTransaction, /api/block/getHeadingLevelTransaction, and /api/block/getHeadingInsertTransaction) that return the fully rendered block DOM of a heading and its subtree without applying the publish-access filter used by the normal reader content path. Although their names imply writes, these endpoints only compute and return a transaction payload; they are registered with CheckAuth alone, so they are reachable with a publish RoleReader token, or anonymously when Publish.Auth.Enable is false. An attacker who supplies any heading block ID receives rendered HTML for that heading's subtree, letting them read the full content of documents an administrator explicitly marked publish-disabled (CWE-862, missing authorization). Anyone running SiYuan with publish mode enabled on port 6808 is affected — anonymous readers when publish authentication is disabled, and any reader-account holder otherwise. No public PoC, KEV listing, or in-the-wild exploitation is known; EPSS is 0.2%.

What to do: Upgrade SiYuan to a patched release as soon as the vendor publishes one (no fixed version is specified in the available data — check the SiYuan release notes/changelog). Until then, keep Publish.Auth.Enable enabled and restrict inbound access to port 6808, or block/deny the /api/block/getHeading*Transaction routes at a reverse proxy for unauthenticated/reader traffic. Review whether any publish-disabled documents were exposed to readers and, if confidentiality matters, rotate or restrict access to that content.